1. Field of the Invention
The invention generally relates to a system and method for an information vault and, more particularly, to a system and method for an information vault and controlling access to the information vault.
2. Background Description
As the world becomes more wired and electronic storage becomes cheaper than the cost of paper, the protection of information becomes paramount. The ease with which information can be copied and propagated causes serious information privacy issues. Keeping information safe and secure is thus one of the biggest issues facing the information technology (IT) industry today.
There are several areas of concern regarding the protection of information including the danger of unrecoverable loss of the information itself and defense against unauthorized copying of the digital information. Also, the control of access to the information may pose certain risk factors to the owner of the information and to the thousands of other organizations who hold copies of this information for business reasons. Ultimately, there may be a potential loss of financial opportunity based on the use of the information.
Unrecoverable loss of data is familiar to nearly everyone. Important documents, images, and financial information are frequently lost not only for individuals but small organizations as well as large. Unrecoverable loss may undermine a business' future to continue or operate.
Further, unauthorized replication of information is a serious problem and may be illustrated with the notion of information theft of credit card numbers. While it is unlikely that the illicit copying of digital objects may be completely eradicated, original access to personal information needs to be controlled tighter. For example, access to medical records, credit card and other financial information needs to be managed so that privacy is maintained more rigorously. Additionally, the transit of this personal information needs to be protected as well as facilitated, such as, the passing of credit card and transaction information, medical records, and the like.
Each business that holds private and personal information supposedly has a responsibility to protect that information and typically builds an infrastructure to protect the information from compromise. The level of management and protection of information and, in particular, personal information, is becoming a legislated issue with governments passing laws requiring organizations to notify the information owners when the privacy of the information may have been compromised. Organizations typically must inform users how they ensure that key information remains private and how they affect disclosure.
Also, business processes (e.g., charging, shipping) as performed today, require customers to provide these businesses with their personal financial and address information and often other information to complete the transactions. Once provided to the business, it may be vulnerable to compromise and not all businesses can apply appropriate resources to protect it.
Ultimately, information is valuable. The illicit use of information could cause a financial loss to the owner or confer an unfair advantage to another party. For example, organizations collect personal information and preferences and sell them on the open market as phone lists, market research, or the like. The individual who owns this information (i.e., the person themselves) never gets directly or indirectly compensated. Instead, the information compilers or middlemen essentially take an individual's information and sell the information. Not only does the individual not get compensated for the middlemen's and advertisers' use of the information but are also indiscriminately solicited or spammed as a result.
Typically, the current common solution involves each “second party”, i.e., the entities an individual may give personal information to, “to promise” via privacy policies that are long and difficult to read, to not compromise or sell information. It is common knowledge that these policies are then either ignored or having been slyly worded, the private personal information is shared with others. Or, the private information is merely stolen by outsiders or insiders at any of the thousands of entities that store personal information.
Examples of attempts to address information privacy issues include Microsoft® Corporation which has implemented a centralized, single sign on/authentication service called Passport which may store your private information and provide it only to web sites that have agreed to certain privacy agreements. Microsoft also has tried to implement Hailstorm, a centralized storage system with charges for people to store their data. The Liberty Alliance project is another example effort to provide similar single sign on specifications that vendors may provide.
Also, American Express has implemented a “Private Payment” service where a user obtains a special card number (requested in real-time by a user at the Amex web site) to use for a web purchase so that no one ever sees an individual's real card number. This number looks like an Amex card number and has an expiration date of a month or so.
However, each of these implementations has not addressed allowing an owner of the information to control access to the personal data and to enable value to flow to the owner of the personal information.